new security model: no more public links, only html pages can execute js (with a warning)
flash empty fields when attempting to encrypt
Merge branch 'master' into gh-pages